redline | 49025966d2dd612fc1e423b01620debfd4c97701aefe26a836cea9e2f2d6ab47

General

Target

49025966d2dd612fc1e423b01620debfd4c97701aefe2.exe
Size

1.0MB
MD5

d6109df4ffa4303e3c30ba997735b689
SHA1

65ac8413b14d7ccb6c848e849caa0de7900116ee
SHA256

49025966d2dd612fc1e423b01620debfd4c97701aefe26a836cea9e2f2d6ab47
SHA512

5e735b12e77ab991c9d54b701645268579f154573aa8a04d8bf2cdb5ed59d3a8ede9f5e55cbce848cd5323fa1e6b3950d12ec5bb7a0bebb403d3711979e1cc8b

Score

10^/10

redline 1111 discovery infostealer spyware stealer

Malware Config

Extracted

Family

redline

Botnet

1111

C2

65.21.144.202:62942

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3980-128-0x0000000000590000-0x00000000005AC000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
3948	Immobilita.exe.com
3736	Immobilita.exe.com
3980	RegAsm.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3736 set thread context of 3980	3736	Immobilita.exe.com	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
212	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3980	RegAsm.exe
3980	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3980	RegAsm.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 2440	3724	49025966d2dd612fc1e423b01620debfd4c97701aefe2.exe	75
PID 3724 wrote to memory of 2440	3724	49025966d2dd612fc1e423b01620debfd4c97701aefe2.exe	75
PID 3724 wrote to memory of 2440	3724	49025966d2dd612fc1e423b01620debfd4c97701aefe2.exe	75
PID 2440 wrote to memory of 2712	2440	cmd.exe	77
PID 2440 wrote to memory of 2712	2440	cmd.exe	77
PID 2440 wrote to memory of 2712	2440	cmd.exe	77
PID 2712 wrote to memory of 4032	2712	cmd.exe	79
PID 2712 wrote to memory of 4032	2712	cmd.exe	79
PID 2712 wrote to memory of 4032	2712	cmd.exe	79
PID 2712 wrote to memory of 3948	2712	cmd.exe	80
PID 2712 wrote to memory of 3948	2712	cmd.exe	80
PID 2712 wrote to memory of 3948	2712	cmd.exe	80
PID 2712 wrote to memory of 212	2712	cmd.exe	81
PID 2712 wrote to memory of 212	2712	cmd.exe	81
PID 2712 wrote to memory of 212	2712	cmd.exe	81
PID 3948 wrote to memory of 3736	3948	Immobilita.exe.com	82
PID 3948 wrote to memory of 3736	3948	Immobilita.exe.com	82
PID 3948 wrote to memory of 3736	3948	Immobilita.exe.com	82
PID 3736 wrote to memory of 3980	3736	Immobilita.exe.com	86
PID 3736 wrote to memory of 3980	3736	Immobilita.exe.com	86
PID 3736 wrote to memory of 3980	3736	Immobilita.exe.com	86
PID 3736 wrote to memory of 3980	3736	Immobilita.exe.com	86
PID 3736 wrote to memory of 3980	3736	Immobilita.exe.com	86

C:\Users\Admin\AppData\Local\Temp\49025966d2dd612fc1e423b01620debfd4c97701aefe2.exe
"C:\Users\Admin\AppData\Local\Temp\49025966d2dd612fc1e423b01620debfd4c97701aefe2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\cmd < Convertira.xls
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V /R "^UNkJJcORLwTPMDHRmEAwfHRFAGvpIPVddQfdtvAkCrkhWSsYbERcArMjWGpeZEpVyDnVgdMrrgnjcDIHfb$" Dio.xls
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Immobilita.exe.com
      Immobilita.exe.com b
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Immobilita.exe.com
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Immobilita.exe.com b
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
        
        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3980
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 30
      4⤵
      Runs ping.exe
      PID:212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3736-127-0x0000000001400000-0x00000000014BD000-memory.dmp

Filesize
756KB

Download
memory/3980-128-0x0000000000590000-0x00000000005AC000-memory.dmp

Filesize
112KB

Download
memory/3980-133-0x0000000004F80000-0x0000000004F81000-memory.dmp

Filesize
4KB

Download
memory/3980-134-0x00000000049F0000-0x00000000049F1000-memory.dmp

Filesize
4KB

Download
memory/3980-135-0x0000000004A50000-0x0000000004A51000-memory.dmp

Filesize
4KB

Download
memory/3980-136-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download
memory/3980-137-0x0000000004970000-0x0000000004F76000-memory.dmp

Filesize
6.0MB

Download
memory/3980-138-0x0000000004D00000-0x0000000004D01000-memory.dmp

Filesize
4KB

Download
memory/3980-140-0x0000000005880000-0x0000000005881000-memory.dmp

Filesize
4KB

Download
memory/3980-141-0x0000000005E20000-0x0000000005E21000-memory.dmp

Filesize
4KB

Download
memory/3980-142-0x00000000064F0000-0x00000000064F1000-memory.dmp

Filesize
4KB

Download
memory/3980-143-0x0000000006BF0000-0x0000000006BF1000-memory.dmp

Filesize
4KB

Download
memory/3980-144-0x0000000006320000-0x0000000006321000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing